feat(git-sync): per-space toggle for conflict-marker handling on push (#13)

Red-team #13 (conflict markers reaching Docmost) is now a per-space policy
exposed as a UI toggle, instead of a hardcoded behavior. New boolean
`gitSync.autoMergeConflicts` (default FALSE), mirroring the existing per-space
`gitSync.enabled` flag end-to-end (jsonb space settings -> update-space DTO ->
space.service -> client types -> space settings form switch):

- OFF (default, safe): a page whose committed body still has unresolved git
  conflict markers is NOT pushed — it is recorded as a per-page push FAILURE
  ("unresolved conflict markers — resolve in git first"). Recording a failure
  (not a soft skip) deliberately HOLDS refs/docmost/last-pushed so the conflict
  commit is never marked pushed and a later pull cannot clobber the user's
  in-progress resolution; the page retries until the conflict is resolved in git.
- ON: the marker lines are stripped and both sides' content is pushed (the prior
  behavior), so the conflict becomes visible/fixable inside Docmost.

The engine Settings carries `autoMergeConflicts`; runPush threads it into the
update AND create paths. The orchestrator's buildSettings reads the per-space
flag from jsonb (strict opt-in like `enabled`, default false).

Tests: redteam-push-cycle #13 rewritten (default -> not pushed + failure + refs
held; ON -> strip-and-push); space.service + edit-space-form + orchestrator
specs extended. git-sync vitest 618, server jest space+git-sync 163, client
edit-space-form 11, server/client tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/server/src/core/space/dto/update-space.dto.ts

@@ -19,4 +19,8 @@ export class UpdateSpaceDto extends PartialType(CreateSpaceDto) {
   @IsOptional()
   @IsBoolean()
   gitSyncEnabled?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  autoMergeConflicts?: boolean;
 }

apps/server/src/core/space/services/space.service.spec.ts

@@ -151,5 +151,70 @@ describe('SpaceService', () => {
       expect(spaceRepo.updateGitSyncSettings).toHaveBeenCalledTimes(1);
       expect(auditService.log).not.toHaveBeenCalled();
     });
+
+    // --- autoMergeConflicts: a SECOND key in the SAME `gitSync` jsonb object,
+    // persisted the same way as `enabled` (the repo's jsonb-merge keeps siblings).
+    it('persists autoMergeConflicts via updateGitSyncSettings(autoMergeConflicts)', async () => {
+      const { svc, spaceRepo } = buildService({});
+
+      await svc.updateSpace(
+        { spaceId, autoMergeConflicts: true } as any,
+        workspaceId,
+      );
+
+      expect(spaceRepo.updateGitSyncSettings).toHaveBeenCalledWith(
+        spaceId,
+        workspaceId,
+        'autoMergeConflicts',
+        true,
+        expect.anything(),
+      );
+    });
+
+    it('does not call updateGitSyncSettings when autoMergeConflicts is undefined', async () => {
+      const { svc, spaceRepo } = buildService({});
+
+      await svc.updateSpace({ spaceId } as any, workspaceId);
+
+      expect(spaceRepo.updateGitSyncSettings).not.toHaveBeenCalled();
+    });
+
+    it('writes a SPACE_UPDATED audit delta on a REAL autoMergeConflicts change (false -> true)', async () => {
+      // Prior persisted state: gitSync.autoMergeConflicts = false; flip it on.
+      const { svc, auditService } = buildService({
+        gitSync: { autoMergeConflicts: false },
+      });
+
+      await svc.updateSpace(
+        { spaceId, autoMergeConflicts: true } as any,
+        workspaceId,
+      );
+
+      expect(auditService.log).toHaveBeenCalledTimes(1);
+      expect(auditService.log).toHaveBeenCalledWith(
+        expect.objectContaining({
+          resourceId: spaceId,
+          spaceId,
+          changes: {
+            before: expect.objectContaining({ autoMergeConflicts: false }),
+            after: expect.objectContaining({ autoMergeConflicts: true }),
+          },
+        }),
+      );
+    });
+
+    it('does NOT write an audit delta on a no-op autoMergeConflicts (same value true -> true)', async () => {
+      const { svc, spaceRepo, auditService } = buildService({
+        gitSync: { autoMergeConflicts: true },
+      });
+
+      await svc.updateSpace(
+        { spaceId, autoMergeConflicts: true } as any,
+        workspaceId,
+      );
+
+      expect(spaceRepo.updateGitSyncSettings).toHaveBeenCalledTimes(1);
+      expect(auditService.log).not.toHaveBeenCalled();
+    });
   });
 });

apps/server/src/core/space/services/space.service.ts

@@ -229,6 +229,25 @@ export class SpaceService {
         );
       }
 
+      if (typeof updateSpaceDto.autoMergeConflicts !== 'undefined') {
+        const prev = settingsBefore?.gitSync?.autoMergeConflicts ?? false;
+        if (prev !== updateSpaceDto.autoMergeConflicts) {
+          before.autoMergeConflicts = prev;
+          after.autoMergeConflicts = updateSpaceDto.autoMergeConflicts;
+        }
+
+        // Merges into the SAME `gitSync` jsonb object as `enabled` (the repo's
+        // jsonb-merge preserves sibling keys), so toggling one never clobbers the
+        // other.
+        await this.spaceRepo.updateGitSyncSettings(
+          updateSpaceDto.spaceId,
+          workspaceId,
+          'autoMergeConflicts',
+          updateSpaceDto.autoMergeConflicts,
+          trx,
+        );
+      }
+
       updatedSpace = await this.spaceRepo.updateSpace(
         {
           name: updateSpaceDto.name,

apps/server/src/integrations/git-sync/services/git-sync.orchestrator.spec.ts

@@ -122,7 +122,19 @@ function build(opts: BuildOptions = {}): Built {
   };
   const redisService = { getOrThrow: jest.fn(() => redis) };
 
-  const db = {};
+  // Chainable Kysely stub. `buildSettings` reads the space's
+  // `gitSync.autoMergeConflicts` flag via
+  // `selectFrom('spaces').select(...).where('id','=',id).executeTakeFirst()`;
+  // default it to the SAFE off value. `enabledSpaces` uses `.execute()`.
+  const db = (() => {
+    const builder: any = {
+      select: () => builder,
+      where: () => builder,
+      executeTakeFirst: async () => ({ autoMergeConflicts: false }),
+      execute: async () => [],
+    };
+    return { selectFrom: () => builder };
+  })();
 
   // The REAL SpaceLockService, constructed against the mock redis above, so all
   // existing lock assertions (lock-held, in-progress, leader lock, release CAS,

apps/server/src/integrations/git-sync/services/git-sync.orchestrator.ts

@@ -107,11 +107,24 @@ export class GitSyncOrchestrator implements OnModuleInit, OnModuleDestroy {
    * datasource writes in-process — so they are placeholders; only `vaultPath`,
    * `gitRemote`, and the tunables are load-bearing.
    */
-  private buildSettings(spaceId: string): Settings {
+  private async buildSettings(spaceId: string): Promise<Settings> {
     const remoteTemplate = this.environmentService.getGitSyncRemoteTemplate();
     const gitRemote = remoteTemplate
       ? remoteTemplate.replace(/\{spaceId\}/g, spaceId)
       : undefined;
+    // Per-space PUSH policy for still-conflicted page bodies (SPEC §9): read the
+    // `gitSync.autoMergeConflicts` flag from the space's jsonb settings. STRICT
+    // opt-in like `enabled` — anything other than the literal 'true' (absent, null,
+    // 'false') resolves to the SAFE default (skip a conflicted page, do not push).
+    const row = await this.db
+      .selectFrom('spaces')
+      .select(
+        sql<boolean>`settings->'gitSync'->>'autoMergeConflicts' = 'true'`.as(
+          'autoMergeConflicts',
+        ),
+      )
+      .where('id', '=', spaceId)
+      .executeTakeFirst();
     return {
       docmostApiUrl: 'http://native.local',
       docmostEmail: 'native@local',
@@ -122,6 +135,7 @@ export class GitSyncOrchestrator implements OnModuleInit, OnModuleDestroy {
       pollIntervalMs: this.environmentService.getGitSyncPollIntervalMs(),
       debounceMs: this.environmentService.getGitSyncDebounceMs(),
       logLevel: 'info',
+      autoMergeConflicts: row?.autoMergeConflicts ?? false,
     };
   }
 
@@ -249,7 +263,7 @@ export class GitSyncOrchestrator implements OnModuleInit, OnModuleDestroy {
     signal?: AbortSignal,
   ): Promise<GitSyncRunStatus> {
     const { runCycle } = await loadGitSync();
-    const settings = this.buildSettings(spaceId);
+    const settings = await this.buildSettings(spaceId);
     const vault = await this.vaultRegistry.getVault(spaceId);
     const client = this.dataSource.bind({ workspaceId, userId: serviceUserId });
     const maxDeletes = this.environmentService.getGitSyncMaxDeletesPerCycle();